AI Security Engineer roadmap
Securing systems where the interpreter is a model, the payload is natural language, and the thing you're defending can be talked into acting against its operator. Classical security knowledge is necessary here and nowhere near sufficient.
14 stages248 topics
This role sits at the intersection of two disciplines and demands real depth in both. If you come from security, sections 3 and 4 are your gap. If you come from ML or AI engineering, sections 2 and 11 are. The defining skill - section 6, the trust boundary - belongs to neither field's existing training, which is why the role exists at all.
Security Foundations
Skip if you already work in security. If you came from ML or AI engineering, this is your largest gap and it cannot be shortcut - AI security is a specialisation of security, not a replacement for it.
ML and LLM Foundations
Skip if you build AI systems already. If you came from security, you need enough to reason about failure modes rather than treat the model as a black box.
The AI Attack Surface
The map. Learn the taxonomy before the techniques, so you can reason about a novel system rather than pattern-match to known exploits.
Prompt Injection
The defining vulnerability class. Deep enough that it earns its own section, and unsolved enough that mitigation, not prevention, is the honest framing.
Agent Security
Where injection stops being an embarrassment and becomes an incident. Agents act; that changes everything about the risk calculus.
Data and Training Attacks
Model-Level Attacks
Lower priority for most application security work, higher priority if you work on models themselves. Know the concepts; go deep only if the role demands it.
ML Supply Chain
The most classically security-shaped part of this role, and the most neglected in practice.
Defensive Engineering
Building the controls, not just finding the holes. This is what makes the role an engineering job rather than a testing one.
Red Teaming
The practice, done rigorously. The difference between a red teamer and someone posting jailbreak screenshots is measurement.
Measurement
Security claims about AI systems are only as good as their statistics. This is where the field is weakest and where you can differentiate fastest.
Governance and Compliance
Enough to work with the people who own it. Security engineers who can speak this language get their mitigations funded.
Incident Response
AI incidents look different: no exploit, no crash, just a system that did something it shouldn't have because someone asked it nicely in a PDF.
Professional Practice
Proving the transition
This field is small enough that public work gets read. Three artifacts, in this order.
1. A documented assessment of a real system
- A system you have permission to test - your employer's, or your own build
- A written threat model with trust boundaries drawn explicitly
- Findings with reproduction steps, impact, and proposed mitigation
- Honest coverage notes: what you tested and what you didn't
2. A reusable evaluation harness
- An automated injection and jailbreak suite that runs in CI
- Attack success rate measured over samples, not anecdotes
- Regression detection when a model or prompt changes
- The artifact that separates engineers from people who post screenshots
3. Public research or contribution
- A write-up of a novel technique, or a rigorous replication of a known one
- A contribution to an open red-teaming or guardrail tool
- Responsible disclosure done properly, including the waiting
The line to hold
- Test only what you are authorised to test, in writing
- Disclose responsibly, and don't publish weaponised artifacts
- Know the computer-misuse law in your jurisdiction before you start
- Sensational demos damage credibility; reproducible measurement builds it
The recurring mistake in this field is treating prompt injection as a content-filtering problem. It is an access-control problem. If a model can be persuaded to take an action, the question is never whether the persuasion can be blocked - it is what the model was permitted to do in the first place.